Decision 074/2020: Capacity of the digital forensics function
Public authority: Chief Constable of the Police Service of Scotland
Case Ref: 201901887
Summary
Police Scotland were asked for information relating to the number of outstanding digital forensic cases.
Police Scotland refused to provide information in response to the Applicant's request as they considered the cost of doing so would exceed the statutory maximum (section 12 of FOISA).
During the investigation, a revised response was issued to the Applicant, where Police Scotland provided some current information for parts of his request but continued to rely on section 12 for the remainder. Police Scotland explained that they did not hold any recorded information for one part of the request. Following this response, the Applicant narrowed the scope of his application to only cover one part of his request.
Following an investigation, the Commissioner agreed that responding to this one part would exceed £600. He also found that Police Scotland did not fully meet their duty to provide the Applicant with advice and assistance.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (3) and (6) (General entitlement); 12(1) (Excessive cost of compliance); 15 (Duty to provide advice and assistance)
The Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 (the Fees Regulations) regulations 3 (Projected costs) and 5 (Excessive cost - prescribed amount)
The full text of each the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 15 August 2019, the Applicant made a request for information to the Chief Constable of the Police Service of Scotland (Police Scotland). In his request, he explained that he was interested in information relating to the number of digital forensics cases outstanding at Police Scotland and requested the following:
a) The number of electronic items currently awaiting initial digital forensic analysis by Police Scotland staff, broken down, if possible, by item type (e.g. mobile phone, tablet, desktop computer).
b) Of these, which case/item has been waiting the longest for analysis.
c) The current average wait time between an item being seized by Police Scotland and the subsequent completion of any digital forensic investigation.
d) Internal management reports or analysis of the capacity of the digital forensics function at Police Scotland, produced within the last 24 months.
2. Police Scotland responded on 11 September 2019 and informed the Applicant that, as it would cost in excess of £600 to provide information to fulfil each part of his request, they were applying section 12(1) of FOISA to refuse the request. Police Scotland explained why it considered that the process of locating, retrieving and providing the relevant recorded information would be excessive for each part of the request.
3. On 11 September 2019, the Applicant wrote to Police Scotland, requesting a review of their decision as he found it difficult to believe that it would be so difficult for Police Scotland to ascertain the information he had requested. The Applicant also commented that he had not been provided with a cost estimate explaining why responding to the request would cost more than £600. The Applicant also indicated that he should have been provided with recommendations on how he could narrow his request in order that he might receive at least some of the requested information.
4. Police Scotland notified the Applicant of the outcome of their review on 9 October 2019. In their response, Police Scotland upheld their reliance on section 12(1) of FOISA for all parts of the Applicant's request. They provided a breakdown of the estimated cost of responding to each part of the request. Police Scotland also explained that they did not contact the Applicant, or provide advice and assistance to him, as they believed there was no viable option to narrow his request which would provide the detailed information he requested.
5. On 14 October 2019, the Applicant wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of Police Scotland's review because they claimed they could not satisfy any component of his FOI request. The Applicant was particularly surprised that they were unable to release any documentation relating to part d) of the request.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
7. On 11 November 2019, Police Scotland were notified in writing that the Applicant had made a valid application. The case was then allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and to answer specific questions as to the actions they would need to take to locate, retrieve and provide information, including details of the systems and resources involved. Submissions were invited on the nature of the steps taken by Police Scotland to help the Applicant reduce the cost of providing the requested information. Police Scotland were also asked to respond to specific comments made by the Applicant in his application, as to why he believed Police Scotland should be able to access management reports relevant to his request.
9. Following the Commissioner's request for submissions, Police Scotland issued a revised review outcome to the Applicant on 20 December 2019, providing some current information which would partially answer parts a) and b) of his request. They continued to rely on section 12 for other relevant, recorded information which is held for these parts. They also continued to rely on section 12(1) for information which would fulfil part d) of his request and notified the Applicant, in line with section 17(1) of FOISA, that no information was held which would fulfil part c) of his request.
10. Having received this revised response, the Applicant informed the Commissioner that he now wanted the scope of the investigation in this case to be limited to part d) of his request only. In light of this, further submissions were sought from Police Scotland regarding the specific actions they would have to take to locate, retrieve and provide information which would fulfil part d) of the Applicant's request. Further submissions were provided on this question.
Commissioner's analysis and findings
11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and Police Scotland. He is satisfied that no matter of relevance has been overlooked.
Section 12(1) - Excessive cost of compliance
12. Section 12(1) provides that a Scottish public authority is not obliged to comply with a request for information where the estimated cost of doing so would exceed the relevant amount prescribed in the Fees Regulations. This amount is current set at £600 (regulation 5 of the Fess Regulations). Consequently, the Commissioner has no power to require the disclosure of information should he find that the cost of responding to a request for information exceeds this sum.
13. The projected costs the public authority can take into account are, according to regulation 3 of the Fees Regulations, the total costs (whether direct or indirect) which the authority reasonably estimates it is likely to incur in locating, retrieving and providing the information requested in accordance with Part 1 of FOISA. The public authority may not charge for the cost of determining whether it actually holds the information requested, or whether or not it should provide the information. The maximum rate a Scottish public authority can charge for staff time is £15 an hour.
14. As mentioned above, the decision in this case is focussed solely on Police Scotland's application of section 12 of FOISA for the information covered by part d) of the Applicant's request.
Submissions from the Applicant
15. In his submissions, the Applicant states that he did not believe it tenable to claim it was not possible to provide any management level reporting on the capacity and monitoring of the cybercrime units at Police Scotland.
16. The Applicant also commented that, given the public scrutiny around this issue, in the context of both the introduction of "cyber-kiosks" and critical press about the delays impacting victims of alleged sex crimes, he found it hard to believe that senior management reports appraising the capacity of the service were difficult to find.
Searches and methodology
17. In their responses to the Applicant, Police Scotland explained that there would be a number of management reports generated by different business areas in the course of the timescale covered by the Applicant's request. These reports would relate to the ability of the Cybercrime digital forensics capability. Police Scotland commented that these would be filed on numerous databases allocated to all business areas throughout Police Scotland, which the Cybercrime Unit would not have sight of or access to. Police Scotland explained that these reports would include details of personnel, investigations, operational capability, future projections and investigation techniques.
18. The searches required to extract the relevant material would, Police Scotland explained, include all mail boxes for relevant departments/divisions, and individual mailboxes/files for all personnel who worked within those departments/divisions during the last 24 months.
19. Police Scotland acknowledged that they would hold paper records relevant to this request, but were focusing on their electronic records in evidencing their cost estimates.
20. Regarding those electronic records, Police Scotland explained that they did not have a force-wide Electronic Document Records Management System (EDRMS) or similar in place. The ICT structure within Police Scotland was such that departments or business areas each had a shared drive, within which all electronic records would be stored according to the appropriate local filing structure. In addition, all personnel within those business areas would have their own personal drive (only accessible to them) and a personal email account. There were also shared mailboxes in most business areas.
21. Police Scotland commented that the Applicant's request for "management reports or analysis" was framed in incredibly wide terms, which could not form the basis of a search across any of the potential locations where information of relevance might be stored. Police Scotland asserted that records of relevance could potentially be held anywhere within the organisation and could be in a variety of formats. They provided a list of examples of the types of documentation that might contain information of relevance.
22. In Police Scotland's view, every record would have to be assessed to determine whether or not it is covered by the terms of the request. They submitted that a force-wide search would have to be carried out to locate, retrieve and provide any relevant information.
23. In seeking to evidence why the cost of such force-wide searches would exceed £600, Police Scotland submitted that, if they considered the recorded information held in just one of the Cyber Crime shared drives (within one geographic area), the total number of folders would be 6,512, containing 124,223 files. Police Scotland asserted that this figure would be replicated across Cyber Crime units in other geographic areas. Police Scotland argued that the searches would need to be done by a member of staff paid in excess of the maximum hourly charge of £15 and anticipated that it would take, at a minimum, one minute to check each file. On this basis, they could only check 2,400 files (a small proportion of the total) in the 40 hours which would take the cost up to £600. Police Scotland stated they had not calculated the additional cost of having to check shared and personal drives and mailboxes, which they considered would also be required to locate, retrieve and provide all the relevant information.
24. Within their revised response to the Applicant, Police Scotland referred to a new case management system in use in the Cybercrime Unit, which they explained was now capable of producing management information considered to be relatively accurate. However, Police Scotland confirmed to the investigating officer that this only produced statistical information and not management reports.
Conclusions
25. The Commissioner is satisfied that the estimate provided by Police Scotland for the cost of carrying out searches to be able to respond to part d) of the Applicant's request is reasonable in all the circumstances. It is clear that the breadth of searches required is considerable (force-wide), even although the Applicant's request is focused specifically on the matter of management reports and analysis of the capacity of the digital forensics function. This level of search seems to be unavoidable due to the nature of the ICT systems in use within Police Scotland and the different filing structures and storage requirements in place, depending on local business requirements. This makes searching for information of the type covered by this request problematic and costly. The Commissioner accepts that these factors resulted in costs exceeding the £600 limit in this case.
26. In all the circumstances, the Commissioner is satisfied that part d) of the request could not have been complied with within the £600 cost limit. Consequently, he finds that Police Scotland were entitled to rely on section 12(1) of FOISA and were under no obligation to comply with the request.
Section 15 of FOISA - Duty to provide advice and assistance
27. Section 15 of FOISA requires a Scottish public authority, so far as is reasonable to expect it to do so, to provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
28. Where section 12(1) is engaged, the need for advice and assistance is crucial to the process of refining requests: a requester will not necessarily know how the data is structured within a given authority, or the volume of information held in the relevant systems, when framing a "narrowed" request, unless the authority advises them accordingly. The section 15 duty goes hand in hand, therefore, with section 12(1).
29. In their review outcome (9 October 2019), Police Scotland explained that they did not provide the Applicant with advice or assistance as they believed there was no viable option to narrow the request which would provide the detailed information requested. Police Scotland also responded to the Applicant's comments where he queried why they had difficulty providing the management information when senior police officers had recently provided figures on that topic to MSPs. Police Scotland explained that they assumed the Applicant was referring to the matter of digital kiosks and this was not what he asked for in his original request. Police Scotland invited the Applicant to narrow the scope of his request to this area, if that was what he was interested in, and informed him this would be dealt with as a new request.
30. In their submissions to the Commissioner, Police Scotland explained that their revised review outcome explained the difficulties they faced with responding to part d) of his request in more depth and provided some additional background information to him. Police Scotland noted that they had suggested to the Applicant that he revisit that part of his request in light of their further explanation, where they said if the Applicant clarified exactly what he was looking for they might be able to provide data from 1 June 2019. Police Scotland stated that they had not heard anything further from him about this.
31. Police Scotland submitted that they had also invited the Applicant to enquire regarding cyber kiosks if that was the subject of real interest to him. They also noted that, with the passage of time, there was a wealth of information regarding cyber kiosks available in the public domain.
32. Police Scotland confirmed that they were more than happy to consider a refined or more specific request from the Applicant. They commented that with some additional clarity they might be able to source information of relevance, without some of the difficulties currently faced.
Conclusions
33. On the matter of clarity, Police Scotland commented that the Applicant's request was so vague and subjective in its terminology that every record held would have to be assessed for relevance. They also considered the terminology used by the Applicant to be unclear, non-specific and highly subjective.
34. Under section 1(3) of FOISA, where an authority requires further information in order to identify and locate the requested information, then they can ask the requester to provide this prior to responding to the request.
35. If Police Scotland were unclear about the nature of the information the Applicant was requesting, then they should have sought clarification from him at the time they received his request for information. It is far too late to raise the question of obtaining additional clarity from the Applicant at the stage of an investigation being carried out by the Commissioner.
36. In line with the Scottish Ministers' Code of Practice on the Discharge of Functions by Scottish Public Authorities under FOISA and The Environmental Information (Scotland) Regulations 2004 (the Section 60 Code)[1], Police Scotland could also have provided reasonable advice and assistance to the Applicant (in line with its duty under section 15 of FOISA) to assist him in identifying the information he was seeking, thereby assisting the authority in being able to identify and locate it.
37. The Commissioner appreciates, in their revised outcome, Police Scotland sought to assist the Applicant in narrowing the scope of his request, by explaining the difficulties they had in locating information pertinent to part d) of his request. They also invited the Applicant to clarify the exact data he was looking for, on the basis that they might be able to provide data from 1 June 2019. The Commissioner also acknowledges that the original review outcome invited the Applicant to submit a new request for information about digital kiosks, if that was the area he was particularly interested in.
38. The Commissioner finds that by the end of the investigation, Police Scotland had provided the Applicant with reasonable advice and assistance in re-framing his request to bring it within the £600 cost limit, in line with section 15(1) of FOISA. However, for the reasons set out above, he is not satisfied that this was achieved (and section 15(1) thus complied with) in responding to the request or in the original review outcome.
Decision
The Commissioner finds that, in the respects covered by the application by the close of the investigation, the Chief Constable of the Police Service of Scotland (Police Scotland) generally complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant, in particular by refusing to comply with the request on the basis that section 12(1) of FOISA applied.
The Commissioner is not satisfied, however, that Police Scotland met their duty to provide advice and assistance fully in responding to the request and requirement for review, as required by section 15(1) of FOISA. Given the further information provided to the Applicant subsequently, he does not require any action to be taken in respect of this failure, in response to the application.
Appeal
Should either the Applicant or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
9 June 2020
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(3) If the authority -
(a) requires further information in order to identify and locate the requested information; and
(b) has told the applicant so (specifying what the requirement for further information is), then, provided that the requirement is reasonable, the authority is not obliged to give the requested information until it has the further information.
…
(6) This section is subject to sections 2, 9, 12 and 14.
12 Excessive cost of compliance
(1) Section 1(1) does not oblige a Scottish public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed such amount as may be prescribed in regulations made by the Scottish Ministers; and different amounts may be so prescribed in relation to different cases.
…
15 Duty to provide advice and assistance
(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
(2) A Scottish public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice issued under section 60 is, as respects that case, to be taken to comply with the duty imposed by subsection (1).
Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004
3 Projected costs
(1) In these Regulations, "projected costs" in relation to a request for information means the total costs, whether direct or indirect, which a Scottish public authority reasonably estimates in accordance with this regulation that it is likely to incur in locating, retrieving and providing such information in accordance with the Act.
(2) In estimating projected costs-
(a) no account shall be taken of costs incurred in determining-
(i) whether the authority holds the information specified in the request; or
(ii) whether the person seeking the information is entitled to receive the requested information or, if not so entitled, should nevertheless be provided with it or should be refused it; and
(b) any estimate of the cost of staff time in locating, retrieving or providing the information shall not exceed £15 per hour per member of staff.
5 Excessive cost - prescribed amount
The amount prescribed for the purposes of section 12(1) of the Act (excessive cost of compliance) is £600.
